Default: The default value for the content_type argument is set in the [email] stanza of the alert_actions.conf file. The default value for a new or upgraded Splunk installation is html.

format

Syntax: format=csv | raw | table

Description: Specifies how to format inline results.

Default: The default value for the format argument is set in the [email] stanza of the alert_actions.conf file. The default value for a new or upgraded Splunk installation is table.

footer

Syntax: footer=<string>

Description: Specify an alternate email footer.

Default: The default footer is:

If you believe you've received this email in error, please see your Splunk administrator.

splunk > the engine for machine data.

To force a new line in the footer, use Shift+Enter.

from

Syntax: from=<email_list>

Description: Email address from line.

Default: "splunk@<hostname>"

inline

Syntax: inline=<boolean>

Description: Specifies whether to send the results in the message body or as an attachment. By default, an attachment is provided as a CSV file. See the Usage section.

Default: The default value for the inline argument is set in the [email] stanza of the alert_actions.conf file. The default value for a new or upgraded Splunk installation is false.

graceful

Syntax: graceful=<boolean>

Description: If set to true, no error is returned if sending the email fails for whatever reason. The remainder of the search continues as if the the sendemail command was not part of the search. If graceful=false and sending the email fails, the search returns an error.

Default: false

maxinputs

Syntax: maxinputs=<integer>

Description: Set the maximum number of search results sent via alerts.

Default: 50000

maxtime

Syntax: maxtime=<integer>m | s | h | d

Description: The maximum amount of time that the execution of an action is allowed to take before the action is aborted.

Example: 2m

Default: no limit

message

Syntax: message=<string>

Description: Specifies the message sent in the email.

Default: The default message depends on which other arguments are specified with the sendemail command.

If sendresults=false the message defaults to "Search complete."

If sendresults=true, inline=true, and either sendpdf=false or sendcsv=false, message defaults to "Search results."

If sendpdf=true or sendcsv=true, message defaults to "Search results attached."

Description: Name of a view.xml file to send as a PDF. For example, mydashboard.xml, search.xml, or foo.xml. Generally this is the name of a dashboard, but it could also be the name of a single page application or some other object. Specify the name only. Do not specify the filename extension. The view.xml files are located in <SPLUNK_HOME>/data/ui/views.

priority

Syntax: priority=highest | high | normal | low | lowest

Description: Set the priority of the email as it appears in the email client. Lowest or 5, low or 4, high or 2, highest or 1.

Default: normal or 3

sendcsv

Syntax: sendcsv=<boolean>

Description: Specify whether to send the results with the email as an attached CSV file or not.

Default: The default value for the sendcsv argument is set in the [email] stanza of the alert_actions.conf file. The default value for a new or upgraded Splunk installation is false.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »